[Unit]
Description=Enodia Sentinel - host intrusion detection daemon
After=network.target
Documentation=https://github.com/Enodia/enodia-sentinel

[Service]
Type=simple
ExecStart=/usr/local/bin/sentinel.sh
Restart=on-failure
RestartSec=5

# Needs to read every process's /proc, sockets, and SUID inventory, so it runs
# as root — but with the surface area locked down. It only ever READS the system
# and WRITES to its own log dir.
ProtectSystem=strict
ReadWritePaths=/var/log/enodia-sentinel
ProtectHome=read-only
NoNewPrivileges=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
MemoryDenyWriteExecute=yes
LockPersonality=yes
# CAP_SYS_PTRACE: read other processes' /proc; CAP_DAC_READ_SEARCH: read
# root-owned files (authorized_keys, ld.so.preload) regardless of perms.
AmbientCapabilities=CAP_SYS_PTRACE CAP_DAC_READ_SEARCH

[Install]
WantedBy=multi-user.target